What problem does it solve? Engineering teams preparing for UK Cyber Essentials certification need to know which of the five NCSC technical controls their code, configuration-as-code, and CI pipelines actually satisfy, and which gaps require organisational action outside the codebase. ## Core Features & Use Cases - Five-Control Assessment: Reviews firewalls, secure configuration, user access control, malware protection, and security update management against the NCSC checklist, producing pass/partial/fail ratings per control. - Scoped Modes: Supports assess, pre-deploy, and gap-only modes so you can run a full review, a release-blocking check, or a quick delta of critical findings. - Structured Reporting: Writes dated reports to reports/security/cyber-essentials/ with severity-tagged findings (CE-001...), evidence, remediation steps, and a certification readiness verdict for the code slice. - Use Case: Before a release, run a pre-deploy check on the auth module to confirm MFA, session handling, and secrets management meet Cyber Essentials requirements, then hand off deep OWASP findings to a security-audit workflow. ## Quick Start Ask the assistant to run a Cyber Essentials assessment on the auth module or the whole codebase and generate a compliance report.
